THIS IS (YET ANOTHER) SECURITY RELEASE Which addresses GHSA-6q48-6c7w-9gw2 and the other impacts of the eMudhra certificate compromise: https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/

What's Changed

• SEC: upgradde uv to 0.13.5 (eMudhra s01e04) by @neutrinoceros in #438
• BUG: pin host python to 3.14.x for running a tox matrix by @neutrinoceros in #437
• Always install coverage even on tox fail by @Cadair in #440
• BUG: make calls to uv run isolated from user configuration by @neutrinoceros in #443
• SEC: unpin uv in conda jobs by @neutrinoceros in #441
• SEC: upgrade pypa/cibuildwheel to 4.3.5 (eMudhra, s01e03) by @neutrinoceros in #434
• Add more failing tests by @Cadair in #442

Full Changelog: v3.2.1...v3.2.2

THIS IS (ANOTHER) SECURITY RELEASE Which addresses GHSA-6q48-6c7w-9gw2 and the other impacts of the eMudhra certificate compromise: https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/

What's Changed

• Upgrade cibuildwheel to v4.3.3 by @pllim in #433

Full Changelog: v3.2.0...v3.2.1

THIS IS A SECURITY RELEASE Which addresses GHSA-6q48-6c7w-9gw2 and the other impacts of the eMudhra certificate compromise: https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/

What's Changed

• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #426
• SEC/DEP: upgrade GHA dependencies depending on locked version of certify by @neutrinoceros in #429
• Update astral-sh/setup-uv from 10.2.0 to 10.3.0, actions/download-artifact from 8.0.1 to 8.0.2, actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #432

Full Changelog: v3.1.1...v3.2.0

What's Changed

• Updates docker/setup-qemu-action from 4.2.0 to 4.4.0, pypa/cibuildwheel from 4.2.0 to 4.2.1, astral-sh/setup-uv from 10.0.1 to 10.2.0, pyvista/setup-headless-display-action from 5.0.0 to 5.1.0, and codecov/codecov-action from 7.0.0 to 7.1.1 by @dependabot[bot] in #425
• replace python-version: 3 with latest supported Python by @zacharyburnett in #428

Full Changelog: v3.1.0...v3.1.1

What's Changed

• Updates astral-sh/setup-uv from 9.0.0 to 10.0.1, mamba-org/setup-micromamba from 3.1.0 to 3.2.1, and pyvista/setup-headless-display-action from 4.3 to 5.0 in #424
• Add support for pyodide wheels (#308) by @Alearner12 in #345

New Contributors

• @Alearner12 made their first contribution in #345

Full Changelog: v3.0.3...v3.1.0

What's Changed

• DEP: ensure coverage is installed with toml support by @neutrinoceros in #417
• STY: pin ruff version exactly and fix new violations in v0.16.0 by @neutrinoceros in #411
• MNT: fix a typo in a workflow step name by @neutrinoceros in #415
• DEP: upgrade pypa/gh-action-pypi-publish (support Metadata 2.5) by @neutrinoceros in #418
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #408
• DEP: upgrade cibw (4.0.0 -> 4.2.0) by @neutrinoceros in #420
• Specify name for job which is expected to fail by @astrofrog in #422
• Bump the actions group across 1 directory with 8 updates by @dependabot[bot] in #421

Full Changelog: v3.0.2...v3.0.3

What's Changed

• DEP: allow running python helper scripts with any Python 3.12.x patch version by @neutrinoceros in #410

Full Changelog: v3...v3.0.2

What's Changed

• fix bug in Python version glob expansion (passing incorrect repository URL to supported-pythons) by @zacharyburnett in #405

Full Changelog: v3.0.0...v3.0.1

Breaking Changes

• If a value is provided for coverage uploading (coverage: codecov, coverage: codecov-oidc, or coverage: github), tests must end with a .coverage file at the workspace root. Use the COVERAGE_FILE environment variable; for instance, you can set it explicitly in tox.ini. See the relevant section of the docs for more information.

  set_env =
    COVERAGE_FILE={toxinidir}/.coverage

• The fill:, fill_platforms:, and fill_factors: inputs are now removed in favor of using version glob syntax py3* directly in envs:. For example, to produce the following set of envs:

      envs: |
         - linux: pep8
           pytest: false
         - linux: py311-xdist
         - linux: py312-xdist
         - linux: py313-xdist
         - linux: py314-xdist
         - macos: py311-xdist
         - macos: py312-xdist
         - macos: py313-xdist
         - macos: py314-xdist

  on OpenAstronomy/github-actions-workflows@v2 you would have used fill:, fill_platforms:, and fill_factors::

   uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@v2
     with:
       envs: |
         - linux: pep8
           pytest: false
       fill: true
       fill_platforms: linux,macos
       fill_factors: xdist

  but now with OpenAstronomy/github-actions-workflows@v3 you use a py* version glob instead:

   uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@v3
     with:
       envs: |
         - linux: pep8
           pytest: false
         - linux: py3*-xdist
         - macos: py3*-xdist

What's Changed

• Coverage reporting refactor and cleanup by @Cadair in #397
• Update codecov/codecov-action to 7.0 to fix signature error by @Cadair in #400
• Better Reporting of Coverage Reporting Errors by @Cadair in #399
• Disable codecov comments by @Cadair in #401
• DEP: upgrade cibuildwheel to 4.0.0 by @neutrinoceros in #393
• DEP: upgrade Github Action dependencies by @neutrinoceros in #398
• replace fill: parameter with logic to expand py3* glob syntax in envs by @zacharyburnett in #392

Full Changelog: v2.6.5...v3.0.0

What's Changed

• Do not explicitly specify uv version in calls to setup-uv by @Cadair in #396
• Bump codecov/code-covaction to 7.0 to fix signature verification issue in #400

Full Changelog: v2.6.4...v2.6.5